Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11

Freshlu · 15.06.2010, 14:34

Vorne weg, das ist ein anderer Pc als mein vorheriges Thema!

Guten Tag, nachdem ich Avira und Malwarebytes durchlaufen lassen habe , habe ich diese drei trojaner entdeckt.
Trojan.Fraudpack, Trojan.Fakealert und tr/renos.ewc.11
Ich habe maleware komplett durchscannen lassen:

malewarebyts log:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4199

Windows 6.0.6000
Internet Explorer 8.0.6001.18904

15.06.2010 15:24:10
mbam-log-2010-06-15 (15-24-10).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 377344
Laufzeit: 1 Stunde(n), 48 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\V71IQL7HI7 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Energy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MSSCHU8J\install[1].exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.

daraufhin trojan.fraudpack und trojan.fakealert entfernt und neugestartet aber bin mir sicher dass ich ihn nicht soleicht loshaben werde also hijack!

Nach dem Neustart:
hijack liefert das:

Code:

ATTFilter

HiJackthis Logfile:

	Code: 

 ATTFilter

  
	Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:03, on 15.06.2010
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe
C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Razer\Krait\razerhid.exe
C:\Program Files\Razer\Krait\razerofa.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Seagate\BlackArmorBackup\BlackArmorBackupMonitor.exe
C:\Program Files\Seagate\BlackArmorBackup\TimounterMonitor.exe
C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Opera\opera.exe
C:\Windows\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) -  - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Krait] C:\Program Files\Razer\Krait\razerhid.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [BlackArmorBackupMonitor.exe] C:\Program Files\Seagate\BlackArmorBackup\BlackArmorBackupMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Seagate\BlackArmorBackup\TimounterMonitor.exe
O4 - HKLM\..\Run: [Seagate Scheduler2 Service] "C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a favorites
O4 - Startup: Registration .LNK = C:\Program Files\Ubisoft\Dark Messiah of Might and Magic\RegistrationReminder.exe
O4 - Global Startup: Ashampoo AntiVirus Service.lnk = C:\Program Files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe
O4 - Global Startup: GuardGui.lnk = C:\Program Files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix: 
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avGuard Service (avGuard) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate1cad426b3acfd89) (gupdate1cad426b3acfd89) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Seagate Scheduler2 Service (SgtSch2Svc) - Seagate - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 9413 bytes
         
 --- --- ---

cosinus · 16.06.2010, 12:05

Wir brauchen noch Logs von OTL.exe

Freshlu · 16.06.2010, 18:27

Hi cosinus, danke für die Antwort!
OTL - LOGS:

Extra:
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 16.06.2010 19:18:13 - Run 1
OTL by OldTimer - Version 3.2.6.0     Folder = C:\Users\***\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,64 Gb Total Space | 99,80 Gb Free Space | 14,28% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ***-PC
Current User Name: Energy
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\TheWorld 2.0\TheWorld.exe (Phoenix Studio)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\TheWorld 2.0\TheWorld.exe" "%1" (Phoenix Studio)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\TheWorld 2.0\TheWorld.exe" "%1" (Phoenix Studio)
https [open] -- "C:\Program Files\TheWorld 2.0\TheWorld.exe" "%1" (Phoenix Studio)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C0F8C45-F7F6-40AC-A8DA-DF779816F267}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{19A8154B-8146-431B-B504-E66A0CD325E7}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 | 
"{1EE64599-479D-40B3-A132-D77CBFEB6828}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3AE6EDA4-D951-4B10-A12F-E84787D07916}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{3AEEE6EA-4D80-41EC-A8CA-42B4A531CAE1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5D515443-52D3-4707-9CB4-AECE938DC127}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{8E39CD19-D3B5-483E-B370-E5C17830162A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{907711A3-79E7-4F4A-B12D-F30D0B036B2D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{9929835F-7B39-4248-8B57-1ABFF16CE30C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C12745DF-F4A4-4A20-8970-BC62C7FCADD3}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D19150EA-459A-4867-9D50-591198BE217B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{E42D4D80-1F2B-49E0-9E2A-3E04463D2CE8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{F10A6CE1-9BFA-4BA9-933E-738C84180A7C}" = rport=10243 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{000E074A-14D8-46D0-9685-1EB21F9FC753}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-dede-downloader.exe | 
"{028AAD1C-42AE-430C-80CE-D3D90EA717E0}" = protocol=17 | dir=in | app=c:\gpotato.eu\allods online\bin\aogame.exe | 
"{0EC6A215-C309-4DD2-BC42-A19C3ECC58AA}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{15D66870-1216-4CBD-9407-7C002E31FE2F}" = protocol=6 | dir=in | app=c:\program files\mass effect\masseffectlauncher.exe | 
"{1D168DB6-1A9C-4AF2-B08A-8A0AAEACB9C0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{1FD34035-2CDE-43E5-8D08-AC555411A717}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{2569A11F-C1CF-44B1-AC4D-8670793D82EA}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{304DDF08-D6AD-4BF1-959B-853FC7D702C2}" = protocol=6 | dir=in | app=c:\program files\ubisoft\demo\tom clancy's h.a.w.x\hawx.exe | 
"{3A06A823-DDCF-43FE-98B9-9BAE4E55A4E3}" = protocol=17 | dir=in | app=c:\program files\ubisoft\demo\tom clancy's h.a.w.x\hawx.exe | 
"{3BF7EBB4-F44C-4065-961C-24B02D206DA2}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{44118808-72A3-428D-96E4-7C439D3A0CDE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4A966BAB-C5A5-4C97-89ED-0DD656296DA6}" = protocol=6 | dir=in | app=c:\maxga\snowboundonline\run.exe | 
"{4AE4D83B-158F-40C3-8AD1-B8D1B0182752}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.4.2-dede-downloader.exe | 
"{56E71294-DF94-414A-9858-682EE4779563}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{594E6963-2AC3-49B1-99A5-4713EC41A90B}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{604BF519-73F1-4425-A0F2-70AD3FAC24C7}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe | 
"{60992C7B-1031-4FFC-9AA7-306F5757B830}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{617A0B8A-0418-42C4-AF16-3D3C88133FDD}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{6401360F-D161-4608-978F-6B8C64278745}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-dede-downloader.exe | 
"{688328A6-2F1D-47F6-9DBA-CEF0856196DE}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{6A4E1697-0D39-4EA0-9F46-FD9FD681CA77}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe | 
"{6BF2828B-100F-4BCD-82CC-3633E536DF67}" = protocol=6 | dir=in | app=c:\program files\id software\enemy territory - quake wars\etqw.exe | 
"{71D80DC0-AE65-4D1A-AAB2-513139407EDD}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{7456C4F7-6D4F-405B-9621-DADE1D18277C}" = protocol=17 | dir=in | app=c:\gpotato.eu\allods online\bin\launcher.exe | 
"{775F92E6-916E-4370-A5ED-FDB51ABE609E}" = protocol=6 | dir=out | app=system | 
"{8173BDEB-4E1E-4C18-B04D-B591F17C3B2C}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{82A3E92E-77B5-411F-B84E-CBE5441B7D90}" = protocol=6 | dir=in | app=c:\program files\mass effect\binaries\masseffect.exe | 
"{82FB293F-FB3A-474E-BE81-E0322A143389}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{830A729F-8B6B-49E4-9949-8B9F7DDB7DAE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8371F1B5-C011-44F0-9428-19630331D356}" = protocol=6 | dir=in | app=c:\gpotato.eu\allods online\bin\aogame.exe | 
"{8546DB70-7D2F-404E-8B00-8681A52F8DA4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8718B271-BB4E-43B5-98CC-EA0693C4996D}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.4.2-dede-downloader.exe | 
"{887301B9-72A5-409F-9FF5-3AE39B286496}" = protocol=6 | dir=in | app=c:\gpotato.eu\allods online\bin\launcher.exe | 
"{89244029-D8A4-44CD-B384-BE68C2C4F63E}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{8C97743B-6B78-4B7E-A1B8-74C3EF4E415D}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{95F817DA-221B-48B4-B903-DE776BEAE990}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwaw.exe | 
"{9772CED0-8B59-4102-A96D-6E1AF07AFFFC}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{98771224-6045-40DC-814C-E6D4BD418FDC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9ED7465E-9011-4929-A66A-FA8BB8DCFC1E}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{9F2A8677-8BE3-4F43-AAF6-2DEEC7A3EB00}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{A2E95374-A574-442D-8427-02C1C4BEACD7}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe | 
"{A48A46B3-4CF7-4182-989F-E0414221B49F}" = protocol=6 | dir=in | app=c:\program files\ubisoft\demo\tom clancy's h.a.w.x\hawx_dx10.exe | 
"{A5B22160-693F-45F1-934E-677B4F2E7211}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A77D954E-3889-409E-90DB-C514D45159BD}" = protocol=17 | dir=in | app=c:\program files\ubisoft\demo\tom clancy's h.a.w.x\hawx_dx10.exe | 
"{A78F445E-EB55-4DB3-BAB2-3C84F41C2BF8}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe | 
"{AA43423F-480B-4A89-8B2E-AAD236243D7E}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\peggle extreme\peggleextreme.exe | 
"{AE5EB60C-615B-4E0A-933A-06722EFC14AE}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"{B28909B1-3F24-4377-A4C6-7500C5790926}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's rainbow six vegas\binaries\r6vegas_game.exe | 
"{B40A75EB-0877-4579-8ECB-792A9085A1BA}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe | 
"{B7BCDB79-4315-4533-BFC8-A14A29F7B77F}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's rainbow six vegas\binaries\r6vegas_launcher.exe | 
"{B95C5732-79E5-47CB-AC86-BD231908ED0D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{BCF27D5A-1976-4D87-A070-C562D77E9746}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{C10DAD92-AA75-4352-80D9-52338B92FDB9}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{C2C15F5D-6503-4AB1-B732-F193586E903E}" = protocol=17 | dir=in | app=c:\maxga\snowboundonline\run.exe | 
"{C3AE4845-2131-4D3A-9514-0DF60CA1628E}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's rainbow six vegas\binaries\r6vegas_launcher.exe | 
"{C3D12EF0-72C1-415D-A28E-A9174F1CB43A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\peggle extreme\peggleextreme.exe | 
"{C5E79796-CB6C-495D-B214-08D8CEE88AC1}" = protocol=6 | dir=in | app=c:\program files\id software\enemy territory - quake wars\etqwded.exe | 
"{C634D301-E123-4BBE-A862-57F7BC8E6672}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{C718A294-5F6A-423E-8CA1-0A19C8118AF1}" = protocol=17 | dir=in | app=c:\program files\id software\enemy territory - quake wars\etqw.exe | 
"{E05D8E27-D0AA-4042-9337-69774E6E41DB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E77DA9A5-50E2-4750-9836-0F8776593054}" = dir=in | app=c:\program files\electronic arts\command & conquer 3\retailexe\1.0\cnc3game.dat | 
"{F33B97B3-B312-472E-A0F1-A79FB78770FE}" = protocol=17 | dir=in | app=c:\program files\mass effect\binaries\masseffect.exe | 
"{F539BF84-572C-46B8-90AD-770EBDCF2CEA}" = protocol=17 | dir=in | app=c:\program files\mass effect\masseffectlauncher.exe | 
"{F790461A-02CB-4010-B22C-D229598587B1}" = protocol=17 | dir=in | app=c:\program files\id software\enemy territory - quake wars\etqwded.exe | 
"{FAE7F92C-C863-48B2-841B-9CDEDDD6FC1D}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty - world at war\codwawmp.exe | 
"TCP Query User{05A73940-846A-4BB6-9C53-FE789A4F6393}C:\program files\world of warcraft\repair.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\repair.exe | 
"TCP Query User{0B9B60AC-7318-4D7B-8686-AE116B57480D}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{143A00DA-F7A0-4E41-8200-2DAA35EB6F5A}C:\users\energy\desktop\lan-spiele\cs 1.6\hl.exe" = protocol=6 | dir=in | app=c:\users\energy\desktop\lan-spiele\cs 1.6\hl.exe | 
"TCP Query User{33906937-361A-41FC-9010-C7A76CE4242C}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"TCP Query User{5391C4E2-DC15-4CF8-B197-3BD9EF707EBF}C:\program files\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files\warcraft iii\war3.exe | 
"TCP Query User{689FA317-692C-4476-8463-044DF1B34E6A}C:\users\energy\downloads\spellborn_downloader_1_0_0_4-de.exe" = protocol=6 | dir=in | app=c:\users\energy\downloads\spellborn_downloader_1_0_0_4-de.exe | 
"TCP Query User{69F09393-6E6D-4073-8EEB-B5FD87DD2447}C:\program files\steam\steamapps\hitmann91\counter-strike\hl.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\hitmann91\counter-strike\hl.exe | 
"TCP Query User{6B89A432-D09A-4B31-856D-7DE1E610787A}C:\program files\steam\steamapps\hitmann91\condition zero deleted scenes\hl.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\hitmann91\condition zero deleted scenes\hl.exe | 
"TCP Query User{6BD0F4EB-5BE7-46FD-B880-FE0B0577AD77}C:\users\energy\desktop\cs 1.6\hl.exe" = protocol=6 | dir=in | app=c:\users\energy\desktop\cs 1.6\hl.exe | 
"TCP Query User{7D0C903B-0378-4D19-AB4E-93D21D5DF754}C:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe | 
"TCP Query User{A2A8B549-02B4-4C06-8B7A-583665B78CA1}C:\program files\veoh networks\veoh\veohclient.exe" = protocol=6 | dir=in | app=c:\program files\veoh networks\veoh\veohclient.exe | 
"TCP Query User{A55D68B3-7142-4C43-B8C5-77CE0B5337BC}C:\program files\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"TCP Query User{A8BB091E-F7FC-4190-AB87-59DE5E0F8AAE}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{ABD9B950-72F4-4FD2-962F-1FC78905A80D}C:\program files\steam\steamapps\chucks8\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\chucks8\half-life 2 deathmatch\hl2.exe | 
"TCP Query User{B30AD303-7D73-4CED-AD92-0CD362813784}C:\program files\gmx\gmx multimessenger\messengr.exe" = protocol=6 | dir=in | app=c:\program files\gmx\gmx multimessenger\messengr.exe | 
"TCP Query User{B9187DF1-7ADB-4A9B-961F-16F15A0C2CD6}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{B9F09CD0-A0EB-42B3-9917-C76949B78DC8}C:\users\energy\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=6 | dir=in | app=c:\users\energy\appdata\local\temp\electronicarts_patcher_000.exe | 
"TCP Query User{BDA07786-6BCA-498F-B9E6-046DB0FFA348}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{BF8954F6-0DDC-4A7B-9A83-EF1B6E4DD8E1}E:\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=e:\far cry 2\bin\farcry2.exe | 
"TCP Query User{E43E992C-1EAA-43A9-86AD-7011C8E97C9B}C:\program files\world of warcraft\wow-2.4.0-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.4.0-dede-downloader.exe | 
"TCP Query User{EF007996-1E5E-4584-85AD-542BC3DE59D2}C:\program files\playonline\squareenix\playonlineviewer\pol.exe" = protocol=6 | dir=in | app=c:\program files\playonline\squareenix\playonlineviewer\pol.exe | 
"TCP Query User{F1F09262-34BD-4B50-A152-4DDD7531BAAF}C:\users\energy\downloads\yuleech-stoneage2_ob.exe" = protocol=6 | dir=in | app=c:\users\energy\downloads\yuleech-stoneage2_ob.exe | 
"TCP Query User{FC2854CD-054E-4B35-8158-996AD9489776}C:\users\energy\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe" = protocol=6 | dir=in | app=c:\users\energy\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe | 
"UDP Query User{089416AA-F5FE-4BC0-A7B3-9549F7B0FB94}C:\program files\steam\steamapps\chucks8\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\chucks8\half-life 2 deathmatch\hl2.exe | 
"UDP Query User{1BF7EFD8-ABC2-4A12-970F-F29799C0CF08}C:\program files\world of warcraft\wow-2.4.0-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.4.0-dede-downloader.exe | 
"UDP Query User{299716D9-84C0-45C9-888F-A86AA328DDD0}C:\users\energy\downloads\spellborn_downloader_1_0_0_4-de.exe" = protocol=17 | dir=in | app=c:\users\energy\downloads\spellborn_downloader_1_0_0_4-de.exe | 
"UDP Query User{2A7FF37A-3532-4B47-83FF-2869BE5C84F1}C:\users\energy\downloads\yuleech-stoneage2_ob.exe" = protocol=17 | dir=in | app=c:\users\energy\downloads\yuleech-stoneage2_ob.exe | 
"UDP Query User{3AB0E82B-EF50-4C43-B068-5218585FE918}C:\program files\world of warcraft\repair.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\repair.exe | 
"UDP Query User{4607DC3E-1F77-4CBC-AFF2-407E0D131B68}C:\program files\veoh networks\veoh\veohclient.exe" = protocol=17 | dir=in | app=c:\program files\veoh networks\veoh\veohclient.exe | 
"UDP Query User{46602AD6-7C0E-4478-AC69-ADFD14E87B70}C:\program files\steam\steamapps\hitmann91\counter-strike\hl.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\hitmann91\counter-strike\hl.exe | 
"UDP Query User{4C532A46-817B-4CE9-9712-049721D43C80}C:\program files\gmx\gmx multimessenger\messengr.exe" = protocol=17 | dir=in | app=c:\program files\gmx\gmx multimessenger\messengr.exe | 
"UDP Query User{5344D08A-22E5-4619-95C9-EB0069285E6D}E:\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=e:\far cry 2\bin\farcry2.exe | 
"UDP Query User{65DD3E74-32BE-43BA-A0A8-1E7B3AE26205}C:\program files\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files\warcraft iii\war3.exe | 
"UDP Query User{6AE6EE83-51D4-4505-8E9C-E43D866200D5}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{7A584884-DFB8-4578-A053-089AF14DF845}C:\program files\steam\steamapps\hitmann91\condition zero deleted scenes\hl.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\hitmann91\condition zero deleted scenes\hl.exe | 
"UDP Query User{7CFA880D-6F4E-404F-AFBB-8378101D6773}C:\program files\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files\tmnationsforever\tmforever.exe | 
"UDP Query User{85FE6C77-1D68-4910-B4BE-B078499C3D57}C:\program files\playonline\squareenix\playonlineviewer\pol.exe" = protocol=17 | dir=in | app=c:\program files\playonline\squareenix\playonlineviewer\pol.exe | 
"UDP Query User{885CDB84-7FB7-4FF3-8928-5EBD6486BDF1}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{904E5001-8D41-4DC0-AC5C-142C3F86D6DC}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"UDP Query User{9D8C138F-9BF2-4966-9939-F220E612823F}C:\users\energy\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=17 | dir=in | app=c:\users\energy\appdata\local\temp\electronicarts_patcher_000.exe | 
"UDP Query User{9F7C460D-D7F7-4184-BFD2-3FAFE732D1FA}C:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars jk ii jedi outcast\gamedata\jk2mp.exe | 
"UDP Query User{B9C7D7C3-2BD4-4E1B-AE4E-72C9AB137A5A}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"UDP Query User{CA268C14-619B-4049-9ED0-4CB6A47EEE97}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"UDP Query User{D1BAD3C4-0A48-49EF-88A7-E443B9F99822}C:\users\energy\desktop\lan-spiele\cs 1.6\hl.exe" = protocol=17 | dir=in | app=c:\users\energy\desktop\lan-spiele\cs 1.6\hl.exe | 
"UDP Query User{DA30B7A4-412B-4F0B-978C-686989C869C5}C:\users\energy\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe" = protocol=17 | dir=in | app=c:\users\energy\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe | 
"UDP Query User{F3EC7EA1-C821-455A-AF23-597E9AA4AF36}C:\users\energy\desktop\cs 1.6\hl.exe" = protocol=17 | dir=in | app=c:\users\energy\desktop\cs 1.6\hl.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0405E51E-9582-4207-8F38-AC44201D3808}" = VeohTV BETA
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A0D2EFC-C4FC-446A-8BC3-57A54CE5EADD}" = Opera 10.53
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2B54B4B6-5834-494D-81E6-79AC3955EEE5}_is1" = SnowBound Online
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}" = Need for Speed™ ProStreet
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode
"{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision
"{45105F2B-0294-4354-A92A-5D1F575E24A5}" = FINAL FANTASY XI
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56415658-366E-4E28-A6BD-68EC63E560E0}" = Vegas Pro 9.0
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5731C0A8-B266-451A-8D3F-8066AA21836F}" = Tom Clancy's Rainbow Six Vegas
"{576E71DA-3000-48F6-9B21-B9A70D47DFCF}" = Star Wars JK II Jedi Outcast
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C596FD6-C378-4399-93F1-43A206759B23}" = Tom Clancy's H.A.W.X Demo
"{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{7FC5ACB7-6DA1-4774-0001-2A11ECEB8D31}" = i-Studio 4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Patch
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{958AF490-810C-4D3E-AA82-EBA2CE41DA20}" = Station Launcher
"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ac5dde5-90b3-4f7a-83a4-62a4162fbfcc}" = Nero 9 Trial
"{9DF6EC22-733E-4EDC-AC88-54CAD4BF4E7B}" = BlackArmor Backup
"{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap
"{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor
"{A2F166A0-F031-4E27-A057-C69733219434}_is1" = Runes of Magic
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{A82B049B-14E7-4E0E-946D-024AC4050EF8}" = PlayOnline Viewer & Tetra Master
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AF37F9DE-0726-439E-BC10-43D9195394D0}" = Firebird SQL Server - MAGIX Edition
"{AFAE2B15-89A0-4215-A030-F7B5B478886B}" = Call of Duty(R) - World at War(TM) 1.1 Patch
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit
"{B7A585C8-CE4E-4150-84C6-A13C3CB1379F}" = Enemy Territory - Quake Wars(TM)
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax
"{CBE331E3-CB6B-46a3-A669-2C6DABBA2601}" = TheWorld Browser 2.3 Final (2.3.1.1)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM
"{D4FFD1BE-5741-434C-9064-6B6A90035327}" = Brother HL-2070N
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime
"{DD1865F0-AD73-40FB-B23E-1822E02396FF}" = NVIDIA PhysX
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}" = Counter-Strike(TM)
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E280923D-C5D9-4728-8C79-AC9A0DC75875}" = BioShock
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit
"{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"{E6DA58C0-4EC5-4F5E-B73E-2F22ED30ACFC}" = Razer Krait
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget
"{F855C3AE-992D-4B84-A09D-07103CDCDAC2}" = Compact Wireless-G USB Adapter
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone-Konfigurationsprogramm
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Conan_is1" = Age of Conan: Hyborian Adventures
"Ashampoo AntiVirus_is1" = Ashampoo AntiVirus 1.61
"Ashampoo Magical Snap 2_is1" = Ashampoo Magical Snap 2.30
"Ashampoo Photo Commander 5" = Ashampoo Photo Commander 5
"Ashampoo WinOptimizer 4_is1" = Ashampoo WinOptimizer 4.41
"ASIO4ALL" = ASIO4ALL
"AstrumNival Allods" = Allods Online 1.0.05.41
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Setup.divx.com" = DivX-Setup
"Drakensang_is1" = Drakensang
"FL Studio 9" = FL Studio 9
"Google Chrome" = Google Chrome
"Gothic II" = Gothic II
"GSpot" = GSpot Codec Information Appliance
"Hamachi" = Hamachi 1.0.3.0
"Hardcore" = Hardcore
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"IL Download Manager" = IL Download Manager
"InstallShield_{0405E51E-9582-4207-8F38-AC44201D3808}" = VeohTV BETA
"InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{45105F2B-0294-4354-A92A-5D1F575E24A5}" = FINAL FANTASY XI
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{A82B049B-14E7-4E0E-946D-024AC4050EF8}" = PlayOnline Viewer & Tetra Master
"InstallShield_{AFAE2B15-89A0-4215-A030-F7B5B478886B}" = Call of Duty(R) - World at War(TM) 1.1 Patch
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty(R) - World at War(TM)
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch
"MAGIX Foto Manager 8 D" = MAGIX Foto Manager 8
"MAGIX Fotobuch" = MAGIX Fotobuch 3.6
"MAGIX Music Maker 16 D" = MAGIX Music Maker 16
"MAGIX Music Maker 16 Premium Download-Version D" = MAGIX Music Maker 16 Premium Download-Version
"MAGIX Online Druck Service D" = MAGIX Online Druck Service
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Speed burnR D" = MAGIX Speed burnR
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"MSI Live Update 3" = MSI Live Update 3
"MSNIACC" = MSN Connection Center
"mufin player D" = mufin player
"Neffy" = Neffy 1,3,29,0
"NVIDIA Drivers" = NVIDIA Drivers
"Pacific Poker" = Pacific Poker
"particleIllusion 3.0.4 demo version_is1" = particleIllusion 3.0.4 demo
"particleIllusionSE 2.0.5 trial version_is1" = particleIllusion SE 2.0.5
"Peggle World of Warcraft Edition" = Peggle World of Warcraft Edition
"PoiZone" = PoiZone
"PROHYBRIDR" = 2007 Microsoft Office system
"PunkBusterSvc" = PunkBuster Services
"Sakura" = Sakura
"Sawer" = Sawer
"sm-un1.u32" = Ashampoo Office 2008 (C:\Program Files\Ashampoo\Ashampoo Office 2008)
"Station Launcher" = Station Launcher
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"The Chronicles of Spellborn_is1" = The Chronicles of Spellborn
"TmNationsForever_is1" = TmNationsForever Update 2010-03-15
"Toxic Biohazard" = Toxic Biohazard
"TrueCrypt" = TrueCrypt
"VLC media player" = VLC media player 0.9.4
"Warcraft III" = Warcraft III
"Warhammer Online: Age of Reckoning_is1" = Warhammer Online: Age of Reckoning
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WinX DVD Player_is1" = WinX DVD Player 3.0
"World of Warcraft" = World of Warcraft
"Xvid_is1" = Xvid 1.1.3 final uninstall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 10.06.2010 14:34:19 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung spoolsv.exe, Version 6.0.6000.16386, Zeitstempel
 0x4549b734, fehlerhaftes Modul IMM32.DLL, Version 6.0.6000.16386, Zeitstempel 0x4549bd29,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00003ba4,  Prozess-ID 0x138, Anwendungsstartzeit
 01cb08be40eb917d.
 
Error - 10.06.2010 14:34:24 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung ashAvSrv.exe, Version 0.0.0.0, Zeitstempel 0x47a875db,
 fehlerhaftes Modul IMM32.DLL, Version 6.0.6000.16386, Zeitstempel 0x4549bd29, Ausnahmecode
 0xc0000005, Fehleroffset 0x00003ba4,  Prozess-ID 0x920, Anwendungsstartzeit 01cb08be4eb70ffd.
 
Error - 11.06.2010 13:40:05 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 13.06.2010 10:42:40 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 14.06.2010 11:11:18 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 15.06.2010 05:19:40 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 15.06.2010 10:28:22 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 16.06.2010 05:50:45 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
Error - 16.06.2010 06:34:52 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iw3mp.exe, Version 0.0.0.0, Zeitstempel 0x4859a219,
 fehlerhaftes Modul iw3mp.exe, Version 0.0.0.0, Zeitstempel 0x4859a219, Ausnahmecode
 0xc0000005, Fehleroffset 0x001644b7,  Prozess-ID 0x440, Anwendungsstartzeit 01cb0d3f803e771e.
 
Error - 16.06.2010 13:14:08 | Computer Name = ***-PC | Source = WerSvc | ID = 5007
Description = 
 
[ System Events ]
Error - 12.06.2010 07:43:39 | Computer Name = ***-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 3, Funktion 0.   Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.06.2010 07:43:39 | Computer Name = ***-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 6, Funktion 0.   Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.06.2010 07:43:39 | Computer Name = ***-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.   Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.06.2010 07:44:48 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 13.06.2010 09:43:08 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 14.06.2010 10:12:04 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 15.06.2010 05:20:01 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 15.06.2010 09:28:59 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 16.06.2010 05:05:34 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 16.06.2010 13:12:36 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7026
Description = 
 
 
< End of report >

--- --- ---

OTL:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 16.06.2010 19:18:13 - Run 1
OTL by OldTimer - Version 3.2.6.0     Folder = C:\Users\***\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 56,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 698,64 Gb Total Space | 99,80 Gb Free Space | 14,28% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ENERGY-PC
Current User Name: Energy
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Energy\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Programme\Opera\opera.exe (Opera Software)
PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation)
PRC - C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Programme\Seagate\BlackArmorBackup\TimounterMonitor.exe (Seagate)
PRC - C:\Programme\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
PRC - C:\Programme\Common Files\Seagate\Schedule2\schedul2.exe (Seagate)
PRC - C:\Programme\Seagate\BlackArmorBackup\BlackArmorBackupMonitor.exe (Seagate)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Programme\Internet Explorer\ielowutil.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Ashampoo\Ashampoo AntiVirus\GuardGui.exe (Ashampoo GmbH & Co K.G.)
PRC - C:\Programme\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe ()
PRC - C:\Programme\ASUS\AASP\1.00.46\aaCenter.exe ()
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe ()
PRC - C:\Programme\ASUS\Ai Suite\AiNap\AiNap.exe ()
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Razer\Krait\razerhid.exe ()
PRC - C:\Programme\Razer\Krait\razerofa.exe (Razer Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SgtSch2Svc) -- C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe (Seagate)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Fabs) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (avGuard) -- C:\Programme\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (tdrpman174) Acronis Try&Decide and Restore Points filter (build 174) -- C:\Windows\system32\DRIVERS\tdrpm174.sys (Acronis)
DRV - (timounter) -- C:\Windows\system32\DRIVERS\timntr.sys (Acronis)
DRV - (snapman380) Acronis Snapshots Manager (Build 380) -- C:\Windows\system32\DRIVERS\snman380.sys (Acronis)
DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (fssfltr) -- C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (SVKP) -- C:\Windows\System32\SVKP.sys (AntiCracking)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (AshAvScan) -- C:\Windows\System32\drivers\AshAvScan.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (AsIO) -- C:\Windows\System32\drivers\AsIO.sys ()
DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (RT73) -- C:\Windows\System32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (BrPar) -- C:\Windows\System32\drivers\BrPar.sys (Brother Industries Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.0.7.0088
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.4.1
FF - prefs.js..extensions.enabledItems: videofinder@veoh.com:1.3
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..network.proxy.type: 2
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010.06.09 12:38:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.05.08 03:34:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.05.08 03:34:25 | 000,000,000 | ---D | M]
 
[2009.12.16 16:02:17 | 000,000,000 | ---D | M] -- C:\Users\Energy\AppData\Roaming\mozilla\Extensions
[2010.06.14 16:22:49 | 000,000,000 | ---D | M] -- C:\Users\Energy\AppData\Roaming\mozilla\Firefox\Profiles\gvxgtazp.default\extensions
[2009.10.27 16:19:52 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\gvxgtazp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008.12.19 21:07:53 | 000,002,921 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\daemon-search.xml
[2010.06.10 19:12:18 | 000,000,950 | ---- | M] () -- C:\Users\***AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin-1.xml
[2009.12.20 11:45:23 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin-2.xml
[2010.01.06 22:37:23 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin-3.xml
[2010.01.13 17:55:47 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin-4.xml
[2010.05.05 18:57:42 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin-5.xml
[2010.05.08 03:51:34 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin-6.xml
[2009.11.18 12:42:21 | 000,000,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\FireFox\Profiles\gvxgtazp.default\searchplugins\icqplugin.xml
[2009.06.13 01:18:00 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.06.13 01:18:00 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.12.16 16:02:15 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla.org
[2009.12.16 16:02:14 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.12.16 16:02:14 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009.12.16 16:02:14 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2009.12.16 16:02:14 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009.12.16 16:02:14 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Veoh Browser Plug-in) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll (Veoh Networks Inc)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Seagate\BlackArmorBackup\TimounterMonitor.exe (Seagate)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ai Nap] C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe ()
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BlackArmorBackupMonitor.exe] C:\Programme\Seagate\BlackArmorBackup\BlackArmorBackupMonitor.exe (Seagate)
O4 - HKLM..\Run: [Cpu Level Up help] C:\Programme\ASUS\Ai Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [CPU Power Monitor] C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Krait] C:\Programme\Razer\Krait\razerhid.exe ()
O4 - HKLM..\Run: [LiveMonitor] C:\Programme\MSI\Live Update 3\LMonitor.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Seagate Scheduler2 Service] C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ6\ICQ.exe File not found
O4 - HKCU..\Run: [TrueCrypt] C:\Program Files\TrueCrypt\TrueCrypt.exe (TrueCrypt Foundation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration .LNK = C:\Program Files\Ubisoft\Dark Messiah of Might and Magic\RegistrationReminder.exe File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (GTGina.dll) -  File not found
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Users\Energy\AppData\Roaming\sirtf.exe) - C:\Users\***\AppData\Roaming\sirtf.exe File not found
O24 - Desktop WallPaper: C:\Users\Energy\Pictures\Uhuu\BAM!\3. Shoot am 5.Mai.09\BAAM!.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\Pictures\Uhuu\BAM!\3. Shoot am 5.Mai.09\BAAM!.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{80b8ebd0-9acf-11dd-9dbd-0018391b1bfe}\Shell\AutoRun\command - "" = rundll32.exe url,FileProtocolHandler library.htm
O33 - MountPoints2\{ad1425d7-1414-11df-b11b-0018391b1bfe}\Shell\AutoRun\command - "" = E:\start\Setup.exe -- File not found
O33 - MountPoints2\{ad1425d7-1414-11df-b11b-0018391b1bfe}\Shell\explore\command - "" = E:\start\Setup.exe -- File not found
O33 - MountPoints2\{ad1425d7-1414-11df-b11b-0018391b1bfe}\Shell\open\command - "" = E:\start\Setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.16 19:17:14 | 000,572,416 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2010.06.15 11:33:09 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.06.15 11:32:44 | 003,387,040 | ---- | C] (Piriform Ltd) -- C:\Users\***\Desktop\ccsetup232.exe
[2010.06.15 11:32:36 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010.06.15 11:31:31 | 000,812,344 | ---- | C] (Trend Micro Inc.) -- C:\Users\Energy\Desktop\HJTInstall.exe
[2010.06.02 21:51:48 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2010.06.02 21:51:43 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.06.02 21:51:42 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.06.02 21:51:42 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.02 21:51:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.05.29 16:54:38 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.16 19:19:26 | 003,145,728 | -HS- | M] () -- C:\Users\***\ntuser.dat
[2010.06.16 19:17:15 | 000,572,416 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2010.06.16 19:16:46 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{0C87BF52-E834-441E-850B-4D69275B9FED}.job
[2010.06.16 19:14:17 | 000,003,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.06.16 19:14:14 | 000,003,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.06.16 19:11:40 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.06.16 19:11:34 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.06.16 19:11:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.06.16 19:11:04 | 3219,709,952 | -HS- | M] () -- C:\hiberfil.sys
[2010.06.16 15:40:21 | 002,409,728 | -H-- | M] () -- C:\Users\***AppData\Local\IconCache.db
[2010.06.16 14:45:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.06.15 11:33:30 | 000,001,880 | ---- | M] () -- C:\Users\***\Desktop\HijackThis.lnk
[2010.06.15 11:33:13 | 000,001,676 | ---- | M] () -- C:\Users\***Desktop\CCleaner.lnk
[2010.06.15 11:32:54 | 003,387,040 | ---- | M] (Piriform Ltd) -- C:\Users\Energy\Desktop\ccsetup232.exe
[2010.06.15 11:31:38 | 000,812,344 | ---- | M] (Trend Micro Inc.) -- C:\Users\Energy\Desktop\HJTInstall.exe
[2010.06.11 19:42:10 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010.06.02 21:51:45 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.06.02 21:17:42 | 001,461,736 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.06.02 21:17:42 | 000,641,226 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.06.02 21:17:42 | 000,610,064 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.06.02 21:17:42 | 000,116,620 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.06.02 21:17:42 | 000,103,846 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.05.29 19:14:44 | 000,220,672 | ---- | M] () -- C:\Users\***AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.21 14:14:28 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.06.15 11:33:13 | 000,001,676 | ---- | C] () -- C:\Users\Energy\Desktop\CCleaner.lnk
[2010.06.15 11:32:36 | 000,001,880 | ---- | C] () -- C:\Users\Energy\Desktop\HijackThis.lnk
[2010.06.02 21:51:45 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009.12.29 22:26:09 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.12.19 21:04:25 | 000,717,296 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2008.12.09 14:06:38 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2008.11.21 23:47:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.11.21 23:45:16 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008.11.02 21:44:33 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.11.02 21:44:33 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.09.17 13:12:48 | 001,511,424 | ---- | C] () -- C:\Windows\System32\HDX4MediaReveal.dll
[2008.07.29 18:15:19 | 000,000,146 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2008.07.29 18:15:19 | 000,000,040 | ---- | C] () -- C:\Windows\BRDIAG.INI
[2008.07.29 18:15:19 | 000,000,023 | ---- | C] () -- C:\Windows\Brownie.ini
[2008.07.29 18:15:17 | 000,077,824 | ---- | C] () -- C:\Windows\System32\BROSNMP.DLL
[2008.07.29 18:15:17 | 000,026,624 | ---- | C] () -- C:\Windows\System32\BRGSRC32.DLL
[2008.07.29 18:15:17 | 000,004,608 | ---- | C] () -- C:\Windows\System32\BRGSRC16.DLL
[2008.07.29 18:15:10 | 000,008,975 | ---- | C] () -- C:\Windows\HL-2070N.INI
[2008.07.29 18:12:41 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2008.07.29 18:12:19 | 000,045,056 | ---- | C] () -- C:\Windows\System32\PTRCGER.DLL
[2008.07.04 07:30:37 | 000,000,000 | ---- | C] () -- C:\Windows\msicpl.ini
[2008.07.02 22:12:00 | 000,273,408 | ---- | C] () -- C:\Windows\System32\EmRegSys.dll
[2008.06.25 16:06:21 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.06.25 16:06:20 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008.06.07 21:22:21 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2008.06.04 18:33:06 | 000,001,363 | ---- | C] () -- C:\Windows\System32\WLAN.INI
[2008.06.04 18:25:51 | 000,024,576 | R--- | C] () -- C:\Windows\System32\AsIO.dll
[2008.06.04 18:25:50 | 000,012,664 | ---- | C] () -- C:\Windows\System32\drivers\AsIO.sys
[2008.06.04 18:25:46 | 000,012,096 | ---- | C] () -- C:\Windows\System32\drivers\AsInsHelp64.sys
[2008.06.04 18:25:46 | 000,010,304 | ---- | C] () -- C:\Windows\System32\drivers\AsInsHelp32.sys
[2008.06.04 18:10:47 | 000,015,883 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2008.06.04 18:09:43 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2008.06.04 18:09:40 | 000,008,460 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2008.06.04 18:09:38 | 000,012,536 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2008.06.04 18:03:11 | 000,006,702 | ---- | C] () -- C:\Windows\System32\drivers\FlashSys.sys
[2008.06.04 17:52:30 | 000,483,328 | ---- | C] () -- C:\Windows\System32\HookShield.dll
[2008.06.04 17:52:29 | 000,134,504 | ---- | C] () -- C:\Windows\System32\smdll.dll
[2008.06.04 17:52:29 | 000,036,200 | ---- | C] () -- C:\Windows\System32\Auxiliary.dll
[2008.06.04 17:52:28 | 000,462,848 | ---- | C] () -- C:\Windows\System32\HookMap.dll
[2008.03.11 13:47:24 | 000,884,736 | ---- | C] () -- C:\Windows\System32\HDX4MediaConverter.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.02.23 18:37:00 | 000,037,376 | ---- | C] () -- C:\Windows\System32\dsfCMMLDecoder.dll
[2006.02.23 18:36:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\dsfCMMLRawSource.dll
[2006.02.23 17:37:06 | 000,047,616 | ---- | C] () -- C:\Windows\System32\dsfVorbisDecoder.dll
[2006.02.23 17:36:22 | 000,102,400 | ---- | C] () -- C:\Windows\System32\dsfOggDemux2.dll
[2006.02.23 17:35:56 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dsfOGMDecoder.dll
[2006.02.23 17:35:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dsfNativeFLACSource.dll
[2006.02.23 17:35:40 | 000,049,664 | ---- | C] () -- C:\Windows\System32\dsfFLACDecoder.dll
[2006.02.23 17:34:58 | 000,083,456 | ---- | C] () -- C:\Windows\System32\libFLAC++.dll
[2006.02.23 17:34:56 | 000,106,496 | ---- | C] () -- C:\Windows\System32\libFishSound.dll
[2006.02.23 17:34:38 | 000,029,696 | ---- | C] () -- C:\Windows\System32\libOOOggSeek.dll
[2006.02.23 17:34:26 | 001,108,480 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2006.02.23 17:34:16 | 000,049,152 | ---- | C] () -- C:\Windows\System32\libOOogg.dll
[2006.02.23 17:33:54 | 000,140,288 | ---- | C] () -- C:\Windows\System32\libFLAC.dll
< End of report >

--- --- ---

cosinus · 16.06.2010, 20:05

Sieht ziemlich unuffällig aus. Aber ich trau dem Braten nicht. Mach mal bitte nen Durchgang mit CF:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Freshlu · 17.06.2010, 11:42

Guten Tag,

Logfile:

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-06-16.03 - Energy 17.06.2010  12:15:09.1.2 - x86
ausgeführt von:: c:\users\***\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Ashampoo AntiVirus *On-access scanning disabled* (Outdated) {87430BA8-187A-42D6-A8FE-8E00DF291089}
SP: AntiVir Desktop *disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\log.tmp
c:\users\***\AppData\Roaming\.#
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration .LNK
c:\windows\system32\win.com

.
(((((((((((((((((((((((   Dateien erstellt von 2010-05-17 bis 2010-06-17  ))))))))))))))))))))))))))))))
.

2010-06-15 09:33 . 2010-06-15 09:33	--------	d-----w-	c:\program files\CCleaner
2010-06-15 09:32 . 2010-06-15 09:32	--------	d-----w-	c:\program files\Trend Micro
2010-06-02 19:51 . 2010-06-02 19:51	--------	d-----w-	c:\users\Energy\AppData\Roaming\Malwarebytes
2010-06-02 19:51 . 2010-04-29 13:39	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-02 19:51 . 2010-06-02 19:51	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-06-02 19:51 . 2010-06-02 19:51	--------	d-----w-	c:\programdata\Malwarebytes
2010-06-02 19:51 . 2010-04-29 13:39	20952	----a-w-	c:\windows\system32\drivers\mbam.sys

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-16 11:03 . 2009-06-06 11:20	--------	d-----w-	c:\program files\Warcraft III
2010-06-09 10:38 . 2008-06-03 09:37	--------	d-----w-	c:\programdata\Microsoft Help
2010-06-05 21:01 . 2010-01-06 18:23	--------	d-----w-	c:\program files\Microsoft Silverlight
2010-06-03 11:22 . 2009-05-03 11:11	--------	d-----w-	c:\users\Energy\AppData\Roaming\Hamachi
2010-06-02 20:06 . 2008-06-04 17:10	--------	d-----w-	c:\program files\ICQToolbar
2010-06-02 19:17 . 2006-11-02 15:38	641226	----a-w-	c:\windows\system32\perfh007.dat
2010-06-02 19:17 . 2006-11-02 15:38	116620	----a-w-	c:\windows\system32\perfc007.dat
2010-05-21 12:14 . 2009-10-03 09:10	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-15 15:25 . 2008-12-07 12:35	--------	d-----w-	c:\program files\The Chronicles of Spellborn
2010-05-15 15:04 . 2010-05-15 15:03	--------	d-----w-	c:\program files\Hamachi Backup
2010-05-15 15:03 . 2010-05-15 15:03	25280	----a-w-	c:\windows\system32\drivers\hamachi.sys
2010-05-15 14:55 . 2008-10-17 13:52	--------	d-----w-	c:\program files\TheWorld 2.0
2010-05-13 17:40 . 2008-06-04 17:09	--------	d-----w-	c:\users\Energy\AppData\Roaming\ICQ
2010-05-13 12:16 . 2010-05-13 12:16	--------	d-----w-	c:\program files\Common Files\SWF Studio
2010-05-13 12:10 . 2008-06-04 16:25	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-05-13 12:10 . 2010-05-13 12:10	--------	d-----w-	c:\program files\LucasArts
2010-05-12 11:47 . 2010-05-12 11:47	--------	d-----w-	c:\program files\Neffy
2010-05-10 15:34 . 2008-06-14 10:29	--------	d-----w-	c:\users\Energy\AppData\Roaming\DivX
2010-05-05 22:05 . 2008-06-04 17:06	--------	d-----w-	c:\program files\Opera
2010-05-05 16:57 . 2009-04-15 16:49	--------	d-----w-	c:\users\Energy\AppData\Roaming\Apple Computer
2010-04-05 08:45 . 2010-04-05 08:45	73000	----a-w-	c:\programdata\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-05 08:40 . 2010-04-05 08:40	79144	----a-w-	c:\programdata\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
2010-04-04 18:45 . 2010-04-04 18:45	56766	----a-w-	c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-04 18:45 . 2010-04-04 18:45	56978	----a-w-	c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-04 18:45 . 2010-04-04 18:45	57677	----a-w-	c:\programdata\DivX\Player\Uninstaller.exe
2010-04-04 18:45 . 2010-04-04 18:45	53600	----a-w-	c:\programdata\DivX\Update\Uninstaller.exe
2010-04-04 18:43 . 2010-04-04 18:45	754984	----a-w-	c:\programdata\DivX\Setup\Resource.dll
2010-04-04 18:42 . 2010-04-04 18:45	986904	----a-w-	c:\programdata\DivX\Setup\DivXSetup.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-06-04 1232896]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"TrueCrypt"="c:\program files\TrueCrypt\TrueCrypt.exe" [2010-01-24 1415632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-10-17 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 5369856]
"LiveMonitor"="c:\program files\MSI\Live Update 3\LMonitor.exe" [2006-09-05 497152]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2007-09-06 1426432]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2007-10-16 626176]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"Krait"="c:\program files\Razer\Krait\razerhid.exe" [2006-01-24 147456]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-16 47392]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"BlackArmorBackupMonitor.exe"="c:\program files\Seagate\BlackArmorBackup\BlackArmorBackupMonitor.exe" [2009-07-24 4386112]
"AcronisTimounterMonitor"="c:\program files\Seagate\BlackArmorBackup\TimounterMonitor.exe" [2009-07-24 965600]
"Seagate Scheduler2 Service"="c:\program files\Common Files\Seagate\Schedule2\schedhlp.exe" [2009-07-24 376456]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-25 142120]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Ashampoo AntiVirus Service.lnk - c:\program files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe [2008-6-4 669008]
GuardGui.lnk - c:\program files\Ashampoo\Ashampoo AntiVirus\GuardGui.exe [2008-6-4 669008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

R2 gupdate1cad426b3acfd89;Google Update Service (gupdate1cad426b3acfd89);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-04 133104]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 avGuard;avGuard Service;c:\program files\Ashampoo\Ashampoo AntiVirus\ashAvSrv.exe [2008-03-10 566608]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-05-06 1220608]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2009-06-01 222968]
S3 AshAvScan;AshAvScan;c:\windows\system32\DRIVERS\AshAvScan.sys [2008-03-12 9344]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
.
Inhalt des "geplante Tasks" Ordners

2010-06-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-04 18:43]

2010-06-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-04 18:43]

2010-06-16 c:\windows\Tasks\User_Feed_Synchronization-{0C87BF52-E834-441E-850B-4D69275B9FED}.job
- c:\windows\system32\msfeedssync.exe [2010-04-04 04:54]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.21.0.cab
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\gvxgtazp.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.type - 2
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-17 12:32
Windows 6.0.6000  NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-160634127-110634359-1252968786-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:8a,9c,83,5a,a3,92,1b,f2,cd,bf,cf,63,a8,c7,ca,83,a3,de,95,47,5d,a4,07,
   e9,a0,7d,eb,9c,e8,54,c6,80,2a,56,4a,c6,ac,53,25,3a,49,d1,a5,d8,a5,91,d0,28,\
"??"=hex:4e,ba,c9,55,7a,de,ad,fb,d4,32,cb,98,55,df,75,c4

[HKEY_USERS\S-1-5-21-160634127-110634359-1252968786-1000\Software\SecuROM\License information*]
"datasecu"=hex:10,e5,36,be,97,e0,19,25,0d,fb,a2,b5,9f,c7,82,62,c3,03,44,77,26,
   c6,5e,54,d2,46,6c,f4,fe,3a,5e,7c,5d,03,56,2c,f7,5a,71,bb,82,85,59,1f,8a,a9,\
"rkeysecu"=hex:d9,21,63,79,15,5b,2a,0c,e4,92,d8,45,aa,28,9b,b1
 
.

Zeit der Fertigstellung: 2010-06-17  12:37:21
ComboFix-quarantined-files.txt  2010-06-17 10:37

Vor Suchlauf: 12 Verzeichnis(se), 155.752.865.792 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 156.166.836.224 Bytes frei

- - End Of File - - 01A1061A456EF12D8EE059656F58CAB1

--- --- ---

cosinus · 17.06.2010, 11:47

Sieht ok aus. Noch Probleme?

Warum hat Dein Vista eigentlich noch kein Service Pack installiert??

Freshlu · 17.06.2010, 12:14

hm also bisher kam keine antivir meldung mehr
wegen den service packs, könnte sein weil ich das nie installiert habe weil ich den pc schon aufgegeben habe aber wenn du mir sagst dass nun kein trojaner mehr auf meinem pc ist der meine passwoerter ausspioniert installier ich diese natürlich !
vielen dank Ankathete / hypotenuse

cosinus · 17.06.2010, 12:24

Ok. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Freshlu · 17.06.2010, 17:35

Hi

Superantispyware:

Code:

ATTFilter

 SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 06/17/2010 bei 04:23 PM

Version der Applikation : 4.39.1002

Version der Kern-Datenbank : 5079
Version der Spur-Datenbank : 2891

Scan Art       : kompletter Scann
Totale Scann-Zeit : 02:40:26

Gescannte Speicherelemente  : 677
Erfasste Speicher-Bedrohungen  : 0
Gescannte Register-Elemente  : 7090
Erfasste Register-Bedrohungen  : 0
Gescannte Datei-Elemente     : 260738
Erfasste Datei-Elemente   : 0

Malewarebytes:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4209

Windows 6.0.6000
Internet Explorer 8.0.6001.18904

17.06.2010 18:28:38
mbam-log-2010-06-17 (18-28-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 365709
Laufzeit: 1 Stunde(n), 30 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus · 18.06.2010, 10:25

Keine Funde. Von weiteren Problemen geh ich erstmal nicht aus und empfehle Dir jetzt dringend mal die Updates zu installieren!! Halt Dich an diesen Leitfaden:

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Freshlu · 18.06.2010, 22:24

Beim Sp installieren traf ein fehler auf.
Ich habs runtergeladenn, installiert -> neu starten -> beim hochfahren installiert ers ja nochmal oder biem herunter fahren .. keine ahnung -> konnte nicht installiert werden

cosinus · 19.06.2010, 15:25

Hast Du das komplette Paket manuell heruntergeladen und installiert? Wenn nicht, probier das aus.

Zuerst das SP1 => http://www.microsoft.com/downloads/d...DisplayLang=de
Dann das SP2, das kann erst rauf, wenn SP1 installiert ist => Downloaddetails: Windows Server 2008 Service Pack 2 und Windows Vista Service Pack 2 - Five Language Standalone (KB948465)

16.06.2010, 12:05	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11 Wir brauchen noch Logs von OTL.exe __________________ __________________

17.06.2010, 11:47	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11 Sieht ok aus. Noch Probleme? Warum hat Dein Vista eigentlich noch kein Service Pack installiert?? __________________ --> Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11

17.06.2010, 12:24	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11 Ok. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11

Plagegeister aller Art und deren Bekämpfung: Trojan Fraudpack, Trojan.Fakealert und tr/renos.ewc.11